CBOR encodes byte-string lengths from 0 through 23 directly in the
additional-information field. cbor_object_get_array() only handles 23,
so shorter byte strings leave array_len uninitialized. Reserved values
28 through 30 and the unsupported indefinite-length encoding also fall
through without assigning it.
parse_resp_get_random() then uses the indeterminate value for bounds
checking and as the byte count returned to the hwrng core. This can
reject a valid short response or report an incorrect amount of entropy.
Decode the complete inline-length range and reject unsupported values.
Extended definite-length encodings retain their existing behavior, and
the existing size and INT_MAX checks continue to bound the returned
slice.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
drivers/misc/nsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b327423409..ad4723f4dc452 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -117,7 +117,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
array_len_p = &cbor_object[1];
switch (cbor_short_size) {
- case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
+ case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
array_len = cbor_short_size;
break;
case CBOR_LONG_SIZE_U8:
@@ -132,6 +132,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
case CBOR_LONG_SIZE_U64:
array_len = be64_to_cpup((__be64 *)array_len_p);
break;
+ default:
+ return -EFAULT;
}
if (cbor_object_size < array_offset)
--
2.51.0